Index
Consumer ProtectionKentucky, USA

Kentucky Consumer Data Protection Act (KCDPA)

Summary

Going into effect in 2026, the KCDPA gives Kentucky residents specific rights to control how their personal digital data is collected, used, and sold by large businesses.

Rights & Rules

  • 01.
    You have the right to confirm whether a company is processing your personal data and to access that data.
  • 02.
    You have the right to correct inaccuracies in your personal data or demand that the company delete it.
  • 03.
    You have the right to 'opt-out' of having your data sold to third parties or used for targeted advertising.
  • 04.
    Companies MUST obtain your explicit consent before collecting 'sensitive data' (like your exact GPS location, genetic data, or race/religion).

Penalties

  • 01.
    There is NO 'private right of action,' meaning you cannot sue a company yourself for violating this law. Only the Kentucky Attorney General can enforce the law, levying fines of up to $7,500 per violation.

Verified Citations

Kentucky House Bill 15 (2024)

Source
"A consumer may invoke the consumer rights authorized pursuant to this section at any time by submitting a request to a controller specifying the consumer rights the consumer wishes to invoke. A consumer shall have the right to... confirm whether or not a controller is processing the consumer's personal data... delete personal data..."